Direct answer
A valid live connection does not grant permission to every action or channel. Check the caller's current role and object access when processing messages and delivering events.
Create two isolated rooms
Use two authorized test users with separate synthetic rooms and one intentionally shared room. Document who may subscribe, send or administer each room. Agree harmless messages, logging and cleanup before connecting.
Reference: OWASP WebSocket Security Cheat Sheet.
Test subscription and action
Verify user A can receive the permitted room's test event, then request a subscription or action for B's private room using A's connection. Inspect both the response and events delivered; a generic acknowledgment does not prove the data remained private.
For example, compare a private-room subscription with an allowed shared-room subscription under the same account. Capture the synthetic message identifier and which connection received it, rather than relying only on a successful socket handshake.
- Include a valid shared-room positive control.
- Record actor, room owner and intended action.
- Use synthetic messages and redact session credentials.
Change membership during a connection
Remove A from the shared test room while its connection remains open. Send a new synthetic event and compare delivery with the documented revocation policy. Check the server does not rely solely on membership captured at initial connection.
Retest the live boundary
After a fix, repeat allowed, denied and revoked-membership cases. Confirm an authorized user's live updates still work and document any propagation delay, reconnection behavior or untested message types.
Assessment limits
Message types and event delivery paths vary. A test of one room does not establish protection of every subscription, administrative action or historic message.
Frequently asked questions
Does a room identifier act as permission?
No. The server must check the caller's current access to the referenced room and action.
Why change membership while connected?
Long-lived connections can retain stale authorization; the test checks the promised revocation behavior.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.